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Monitoring with Trackers Based on Semi-Quantitative Models 

In three years of NASA-sponsored research preceding this project, we successfully developed a tech- 
nology for (a) building qualitative and semi-quantitative models from libraries of model-fragments, 
(b) simulating these models to predict future behaviors with the guarantee that all possible behav- 
iors are covered, (c) assimilating observations into behaviors, shrinking uncertainty so that incorrect 
models are eventually refuted and correct models make stronger predictions for the future. 

In our object-oriented framework, a tracker is an object which embodies the hypothesis that 
the available observation stream is consistent with a particular behavior of a particular model. The 
tracker maintains its own status (consistent, superceded, or refuted), and answers questions about 
its explanation for past observations and its predictions for the future. 

In the MIMIC approach to monitoring of continuous systems, a number of trackers are active 
in parallel, representing alternate hypotheses about the behavior of a system. This approach is 
motivated by the need to avoid “system accidents” [Perrow, 1985] due to operator fixation on a 
single hypothesis, as for example at Three Mile Island. 

As we began to address these issues, we focused on three major research directions that 
we planned to pursue over a three-year project: (1) tractable qualitative simulation, (2) semi- 
quantitative inference, and (3) tracking set management. Unfortunately, funding limitations made 
it impossible to continue past year one. 

Nonetheless, we made major progress in the first two of these areas. Progress in the third area 
as slower because the graduate student working on that aspect of the project decided to leave school 
and take a job in industry. I enclose a set of papers on the work describe below. Several papers 
that draw on the research supported during this period appeared in print after the grant period 
ended. 

Tractable Qualitative Simulation 

Giorgio Brajnik and Daniel Clancy, respectively a visitor from Udine Italy and a graduate student in 
our group, have developed a novel method for enforcing temporal logic constraints on the behaviors 
predicted by qualitative simulation. These constraints can be used to improve tractability by 
restricting the simulation to a region of the state space, and to increase expressive power by injecting 
discontinuities. The method has been implemented in TeQSIM, an extension to QSIM, which can 
focus simulation to handle larger, more complex problems, simulate non-autonomous and piecewise- 
continuous systems, reason about boundary condition problems, and incorporate observations into 
the simulation. TeQSIM works by interleaving temporal logic model checking with qualitative 
simulation to constrain and refine the resulting predicted behaviors and to inject discontinuous 
changes into the simulation. 

TeQSIM builds on a temporal logic model checker, which is the result of work with Benjamin 
Shults, a mathematics graduate student in our group who is supported by other funding. Shults 
and I described this work in a paper which recently appeared in the Artificial Intelligence Jour- 
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nal. TeQSIM also exploits several methods previously developed by Clancy for taming intractable 
simulations. 

Brajnik and Clancy discuss the applicability of temporal constraints to tasks ranging from 
simulation to monitoring and control of continuous dynamical systems. In addition to formal 
logical guarantees, they evaluate their method using a real-world control problem in the domain of 
water resources management. 

• Daniel J. Clancy, Giorgio Brajnik and Herbert Kay. 1997. Model Revision: Techniques and 
tools for analyzing simulation results and revising qualitative models . Working notes from 
the 11th International Workshop on Qualitative Reasoning about Physical Systems (QR-97) 

, June 1997. 

• D. J. Clancy and B. J. Kuipers, 1997. Model Decomposition and Simulation: A component 
based qualitative simulation algorithm. Proceedings from the 14th National Conference on 
Artificial Intelligence (AAAI-97), August 1997. 

• D. J. Clancy and B. J. Kuipers, 1997. Static and dynamic abstraction solves the problem of 
chatter in qualitative simulation. Proceedings from the 14th National Conference on Artificial 
Intelligence (AAAI-97), August 1997. 

• D. J. Clancy and B. J. Kuipers, 1997. Dynamic Chatter Abstraction: A scalable technique 
for avoiding irrelevant distinctions during qualitative simulation. Proceedings from the 11th 
International Workshop on Qualitative Reasoning about Physical Systems (QR-97) , June 
1997. 

• Giorgio Brajnik and Daniel J. Clancy. 1997. Focusing qualitative simulation using tem- 
poral logic:Theoretical Foundations To appear in the Annals of Mathematics and Artificial 
Intelligence. 

• Giorgio Brajnik and Daniel J. Clancy. 1997. Control of Hybrid Systems using Qualitative 
Simulation. Working notes from the 11th International Workshop on Qualitative Reasoning 
about Physical Systems (QR-97) , June 1997. 

• Giorgio Brajnik and Daniel J. Clancy. 1996. Temporal constraints on trajectories in qualita- 
tive simulation. In Proceedings of the National Conference on Artificial Intelligence (AAAI- 
96), AAAI/MIT Press, 1996. 

• Giorgio Brajnik and Daniel J. Clancy. 1996. Temporal constraints on trajectories in qual- 
itative simulation. In Working Papers of the Tenth International Workshop on Qualitative 
Reasoning (QR-96), Fallen Leaf Lake, California. 

• Giorgio Brajnik and Daniel J. Clancy. 1996. Guiding and refining simulation using temporal 
logic. Third International Workshop on Temporal Representation and Reasoning (TIME’96), 
1996. 
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Semi-Quantitative Inference 

Over several years, Bert Kay 1 became the master of our toolkit of semi-quantitative reasoning 
methods: Q2, Q3, and his own NSIM. He has now combined and extended these methods to 
create SQsim (for SemiQuantitative SIMulator), a system which provides a general language for 
representing and reasoning about many common types of engineering uncertainty. 

SQsim is a method for representing and simulating Ordinary Differential Equation (ODE) sys- 
tems which are imprecise — that is, where the ODE model contains both parametric and functional 
uncertainty. Such models, while useful in engineering contexts, are not used in practice because 
they require either special structures which limit the describable uncertainty or produce predictions 
which are extremely weak. 

By defining the model both qualitatively and quantitatively and by using a simulation method 
that combines inferences across the qualitative-to-quantitative spectrum, SQsim produces predic- 
tions that maintain a precision consistent with the model imprecision. SQsim is demonstrated on 
a realistic model of a CSTR (continuously stirred tank reactor). SQsim is the core inference engine 
for our work on trackers. 

• Herbert Kay. 1996. SQsim: a simulator for imprecise ODE models. University of Texas 
Artificial Intelligence Laboratory TR AI96-247, March 1996. 

• Herbert Kay. 1996. Refining Imprecise Models and Their Behaviors. Doctoral dissertation, 
Department of Computer Sciences, The University of Texas at Austin, December 1996. 

• Herbert Kay. 1997. Robust identification using semiquantitative methods. IFAC Symposium 
on Fault Detection, Supervision and Safety for Technical Processes (SAFEPROCESS’97), 
Hull, UK, 26-28 August 1997. 

Tracking Set Management 

In our framework for monitoring, a tracker is an object which embodies the hypothesis that the avail- 
able observation stream is consistent with a particular behavior of a particular semi-quantitative 
model. The tracker provides an explanation for past observations and predictions for the future, 
and maintains its own status (consistent, superceded, or refuted). Essentially, a tracker uses SQsim 
to do system identification on the observation stream, starting with the qualitative hypothesis it 
embodies. 

Our MIMIC monitoring approach maintains a number of trackers in parallel, representing al- 
ternate hypotheses about the behavior of a system. This can only be done with finite resources 
because a single semi-quantitative model represents a continuous range of quantitative models. The 
set of trackers grows as new events trigger new hypotheses, and shrinks as observations refute some 

1 1 am very sorry to report that, after receiving his Ph.D. from the University of Texas at Austin and taking a 
position on the research staff at NASA Ames Research Center, Bert Kay died tragically in Palo Alto on June 12, 
1997. In addition to losing a friend and colleague, we have lost an excellent scientist. 
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hypotheses. The set of active trackers can be analyzed to determine which observations will be 
most useful for differential diagnosis. It should be possible to distribute the tracking set across a 
parallel computing system, but managing the growth of the tracking set is a significant research 
problem. 

• Benjamin Kuipers. Monitoring with trackers based on semi-quantitative models. Unpublished 
manuscript. 

Plans for further research 

By the end of the grant year, we expect that our semi-quantitative inference methods will have 
reached maturity, and give us a stable tool to use for tracking research. Research on tractable 
qualitative simulation is making rapid progress right now. Over the next year, these methods will 
be encapsulated in more generally useful tools, and evaluated on additional problems of realistic 
complexity. We expect to have a new implementation of trackers as autonomous system identifica- 
tion modules by the end of the year, so we can begin evaluating tracking set management strategies 
on some example monitoring tasks. 

It is clear that a successful space program requires increasing the autonomy and onboard intel- 
ligence of spacecraft. System monitoring and diagnosis must be autonomous and reliable. Because 
qualitative and semi-quantitative reasoning make it possible to start with a few broad-coverage 
hypotheses and refine them with information from observations, I believe that these methods are 
a critical part of the solution NASA needs. 

Our laboratory is one of the (arguably, the) premiere research group in qualitative reasoning. 
We attract visitors and correspondents from all over the country and the world. Our Web page 
http://www.cs.utexas.adu/users/qr/ gives a comprehensive view of the depth and breadth 
of our work, particularly through our annotated bibliography of publications. We have focused 
on integrating quantitative information with qualitative simulation, on providing the abstraction 
methods necessary for scaling up tractably to realistic problems, and on building models of complex 
systems in science and engineering. 
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1 Abstracts of Selected Papers 

1.1 Tractable Qualitative Simulation 

• Daniel J. Clancy, Giorgio Brajnik and Herbert Kay. 1997. Model Revision: Techniques and 
tools for analyzing simulation results and revising qualitative models. Working notes from 
the 11 th International Workshop on Qualitative Reasoning about Physical Systems (QR-97), 
June 1997. 


Abstract 

One of the factors hindering the wide-spread application of qualitative simulation tech- 
niques is the difficulty encountered when developing a qualitative model. Analyzing the 
resulting behavioral description and revising the model in response to this analysis requires 
a significant amount of expertise and is often left up to the modeler. As a result, developing 
a qualitative model is difficult for users who are not familiar with the field. Furthermore, 
this process is often not addressed within the literature making it difficult for such a user 
to obtain the necessary expertise except through trial and error. This paper addresses the 
process of model revision and presents a set of tools and methods to assist in the perfor- 
mance of this task. It also demonstrates how qualitative simulation can be used to obtain a 
more detailed understanding of the dynamical properties of the modeled system. The tools 
presented help the modeler extract information from a complex behavioral description by 
providing alternative views of the description, allowing the modeler to perform a focused 
search of the potential state space and providing explanation facilities for the branches 
occuring within the description. These tools and the methods are discussed with respect 
to the development of a semi-quantitative model of a controller for a tank. 

• D. J. Clancy and B. J. Kuipers, 1997. Model Decomposition and Simulation: A component 
based qualitative simulation algorithm. Proceedings from the 14 th National Conference on 
Artificial Intelligence (AAAI-97), August 1997. 

Abstract 

Traditionally, qualitative simulation uses a global, state-based representation to de- 
scribe the behavior of the modeled system. For larger, more complex systems this rep- 
resentation proves extremely inefficient since it provides a complete temporal ordering of 
all potential distinctions leading to a large, complex behavioral description that obscures 
relevant distinctions, or even fails to terminate. 

The model decomposition and simulation algorithm (DecSIM) uses a divide and con- 
quer approach to qualitative simulation. Variables within the system are partitioned into 
components. Each component is viewed as a separate system and is simulated using a 
state-based representation limited to the variables within the component. Interactions be- 
tween components are reasoned about separately. DecSIM provides a promising paradigm 
for qualitative simulation whose complexity is driven by the complexity of the problem 
specification rather than the inference mechanism used. 
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# d. J. Clancy and B. J. Kuipers, 1997. Static and dynamic abstraction solves the problem of 
chatter in qualitative simulation. Proceedings from the 14 th National Conference on Artificial 
Intelligence ( AAAI-97 % August 1997. 


Abstract 

One of the major factors hindering the use of qualitative simulation techniques to rea- 
son about the behavior of complex dynamical systems is intractable branching due to a 
phenomenon called chatter. This paper presents two general abstraction techniques that 
solve the problem of chatter. Eliminating the problem of chatter significantly extends the 
range of models that can be tractably simulated using qualitative simulation. 

Chatter occurs when a variable’s direction of change is constrained only by continuity 
within a region of the state space. This results in intractable, potentially infinite branching 
within the behavioral description due to irrelevant distinctions in the direction of change. 
While a number of techniques have been proposed to eliminate chatter, none of them pro- 
vide a general solution that c an eliminate all instances of chatter. Chatter box abstraction 
and dynamic chatter abstraction provide two such solutions to this problem. Both solu- 
tions eliminate chatter by abstracting the chattering region of the state space into a single 
qualitative state with an abstract direction of change. The algorithms differ in the manner 
in which they identify the chattering region of the state space. 

• D. J. Clancy and B. J. Kuipers, 1997. Dynamic Chatter Abstraction: A scalable technique for 
avoiding irrelevant distinctions during qualitative simulation. Proceedings from the 11th In- 
ternational Workshop on Qualitative Reasoning about Physical Systems (QR-97), June 1997. 

Abstract 

One of the major factors hindering the use of qualitative simulation techniques to rea- 
son about the behavior of complex dynamical systems is intractable branching due to a 
phenomenon called chatter. This paper presents a general abstraction technique that pro- 
vides a scalable solution to this problem. This technique is used to simulate models that 
previously could not be simulated to completion. Eliminating the problem of chatter sig- 
nificantly extends the range of models that can be tractably simulated using qualitative 
simulation. 

Chatter occurs when a variable’s direction of change is constrained only by continuity 
within a region of the state space. This results in intractable, potentially infinite branching 
within the behavioral description due to irrelevant distinctions in the direction of change. 
While a number of techniques have been proposed to eliminate chatter, chatter box ab- 
straction [Clancy and Kuipers, 1993] is the only one that provides a general solution that 
can eliminate all instances of chatter. Chatter box abstraction, however, explores the po- 
tentially chattering region of the state space via a restricted simulation that is exponential 
in the number of chattering variables. Dynamic chatter abstraction uses a similar abstrac- 
tion technique; however, the potentially chattering region of the state space is explored 
via a dynamic analysis of the model and the current qualitative state using knowledge of 
the inference capability of the simulation algorithm. Thus, a scalable solution is provided 
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that abstracts chattering regions of the state space into a single state within the behavioral 
description. 

The algorithm is described along with an empirical evaluation demonstrating that dy- 
namic chatter abstraction eliminates all instances of chatter without over-abstracting. This 
evaluation also shows that the algorithm is significantly more efficient than chatter box ab- 
straction and thus supports the simulation of more complex models. 

• Giorgio Brajnik and Daniel J. Clancy. 1997. Focusing qualitative simulation using temporal 
logic:Theoretical Foundations. To appear in Annals of Mathematics and Artificial Intelli- 
gence. 


Abstract 

We illustrate TeQSIM, a qualitative simulator for continuous dynamical systems that 
combines the expressive power of qualitative differential equations with temporal logic to 
constrain and refine the resulting predicted behaviors. Temporal logic is used to spec- 
ify constraints that restrict the simulation to a region of the state space and to specify 
trajectories for input variables. A propositional linear-time temporal logic is adopted, 
which is extended to a three valued logic that allows a formula to be conditionally entailed 
when quantitative information specified in the formula can be applied to a behavior to 
refine it. We present a formalization of the logic with correctness and completeness results 
for the adopted model checking algorithm. We show an example of the simulation of a 
non-autonomous dynamical system and illustrate possible application tasks, ranging from 
simulation to monitoring and control of continuous dynamical systems, where TeQSIM can 
be applied. 

• Giorgio Brajnik and Daniel J. Clancy. 1997. Control of Hybrid Systems using Qualitative 
Simulation. Working notes from the 11th International Workshop on Qualitative Reasoning 
about Physical Systems (QR-97) , June 1997. 

Abstract 

This paper presents a methodology for synthesizing, under uncertainty, a sequence of 
robust, discrete control actions to drive a continuous dynamical plant through admissible 
trajectories specified via temporal logic expressions. An action is defined as a modification 
to the value of a controllable exogenous variable. The TeQSIM algorithm combines quali- 
tative simulation with temporal logic model checking to validate or refine a proposed plan. 
Qualitative simulation is used to infer a branching-time description of the system behav- 
iors that potentially follow from a sequence of control actions. This description is queried 
using temporal logic based goal constraints to perform plan validation. Plan refinement 
infers bounds on the sequence of actions within a plan to guarantee that the specified goal 
constraints are satisfied. 

A framework for plan generation is presented that uses a phase portrait representation 
to reason about the effect of each action within a particular system configuration. Each set 
of distinct values for the controllable exogenous variables defines a separate configuration 
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of the dynamical system. The behavior of the system within each configuration is described 
using a phase portrait representation. These representations are compared to determine 
the effect of an action within a region of the phase plane and to determine when the action 
is appropriate to resolve a goal violation. This methodology is able to prune the plan search 
space by eliminating actions that are unable to resolve a detected violation. 

• Giorgio Brajnik and Daniel J. Clancy. 1996. Temporal constraints on trajectories in qualita- 
tive simulation. In Proceedings of the National Conference on Artificial Intelligence (AAAI- 
96), AAAI/MIT Press, 1996. 


Abstract 

We present a method for specifying temporal constraints on trajectories of dynamical 
systems and enforcing them during qualitative simulation. This capability can be used 
to focus a simulation, simulate non-autonomous and piecewise-continuous systems, rea- 
son about boundary condition problems and incorporate observations into the simulation. 

The method has been implemented in TeQSIM, a qualitative simulator that combines the 
expressive power of qualitative differential equations with temporal logic. It interleaves 
temporal logic model checking with the simulation to constrain and refine the resulting 
predicted behaviors and to inject discontinuous changes into the simulation. 

• Giorgio Brajnik and Daniel J. Clancy. 1996. Temporal constraints on trajectories in qual- 
itative simulation. In Working Papers of the Tenth International Workshop on Qualitative 
Reasoning (QR-96), Fallen Leaf Lake, California. 

Abstract 

We present a new method for specifying temporal constraints on trajectories of dy- 
namical systems and enforcing them during qualitative simulation. Such constraints are 
otherwise inexpressible using standard qualitative reasoning techniques. Trajectory con- 
straints cam be used to restrict the simulation to a region of the state space and to in- 
ject discontinuities. This capability can be used to focus the simulation for larger, more 
complex simulations, simulate non-autonomous and piecewise-continuous systems, reason 
about boundary condition problems and incorporate observations into the simulation. The 
method has been implemented in TeQSIM, a qualitative simulator. It combines the expres- 
sive power of qualitative differential equations with temporal logic by interleaving temporal 
logic model checking with the simulation to constrain and refine the resulting predicted be- 
haviors and to inject discontinuous changes into the simulation. 

The paper discusses the applicability of temporal constraints in tasks ranging from 
simulation to monitoring and control of continuous dynamical systems. We present a real- 
world control problem in the domain of water supply. Finally, the basic algorithm and 
theoretical results (soundness and completeness) are described. 

• Giorgio Brajnik and Daniel J. Clancy. 1996. Guiding and refining simulation using temporal 
logic. Third International Workshop on Temporal Representation and Reasoning ( TIME’96 '), 
1996. 
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Abstract 

We illustrate TeQSIM, a qualitative simulator for continuous dynamical systems. It 
combines the expressive power of qualitative differential equations with temporal logic by 
interleaving simulation with model checking to constrain and refine the resulting predicted 
behaviors. Temporal logic expressions are used to specify constraints that restrict the 
simulation to a region of the state space and to specify trajectories for input variables. A 
propositional linear-time temporal logic is adopted, which is extended to a three valued logic 
that allows a formula to be conditionally entailed when quantitative information specified in 
the formula can be applied to a behavior to refine it. We present a formalization of the logic 
with theoretical results concerning the adopted model checking algorithm (correctness and 
completeness). We show also an example of the simulation of a non-autonomous dynamical 
system and illustrate possible application tasks, ranging from simulation to monitoring and 
control of continuous dynamical systems, where TeQSIM can be applied. 


1.2 Semi-Quantitative Reasoning 

• Herbert Kay. 1996. SQsim: a simulator for imprecise ODE models. University of Texas 
Artificial Intelligence Laboratory TR AI96-247, March 1996. 

Abstract 

This article describes a method for representing and simulating Ordinary Differential 
Equation (ODE) systems which are imprecise - that is, where the ODE model contains 
both parametric and functional uncertainty. Such models, while useful in engineering con- 
texts, are not used in practice because they require either special structures which limit 
the describable uncertainty or produce predictions which are extremely weak. This article 
describes SQsim (for SemiQuantitative SIMulator), a system which provides a general lan- 
guage for representing and reasoning about many common types of engineering uncertainty. 

By defining the model both qualitatively and quantitatively and by using a simulation 
method that combines inferences across the qualitative- to-quantitative spectrum, SQsim 
produces predictions that maintain a precision consistent with the model imprecision. 

• Herbert Kay. 1996. Refining Imprecise Models and Their Behaviors . Doctoral dissertation, 
Department of Computer Sciences, The University of Texas at Austin, December 1996. 

Abstract 

This dissertation describes methods for simulating and refining imprecisely-defined Or- 
dinary Differential Equation (ODE) systems. When constructing a model of a physical 
process, a modeler must cope with uncertainty due to incomplete knowledge of the process. 

For tasks such as design and diagnosis, the effects of this uncertainty must be considered. 
However, predicting the behavior of an imprecisely-defined model is not easy since the 
model covers a space of many precise instances, each of which behaves differently. 

While model uncertainty cannot be completely eliminated, it is possible to reduce it. 
Model refinement uses observations of a physical process to rule out portions of the model 
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space that could not have produced the observations. As more experience with the physical 
process is gained, the imprecision in the model is further reduced. 

This dissertation describes three methods for reasoning with imprecise ODE models. 
SQSim is a simulator that produces a guaranteed bound on the behavior of an imprecise 
ODE model. By using a multiple-level representation and inference methods that span 
the qualitative- to-quantitative spectrum, SQSim produces predictions whose uncertainty 
is consistent with model imprecision. We demonstrate SQSim on a complex, nonlinear 
chemical process and compare it to other methods for simulating imprecise ODE models. 

MSQUID is a function estimator for fitting (and bounding) noisy data that is known to 
be monotonic. It uses a neural-network inspired model and nonlinear constrained optimiza- 
tion to search a space of monotonic functions. We prove that MSQUID can estimate any 
monotonic function and show that it produces better estimates than does unconstrained 
optimization. 

SQUID, which uses SQSim and MSQUID as components, is a system identification 
method that refines an imprecise model using a stream of observations from a physical 
process. SQUID uses refutation to rule out portions of the model space that are inconsistent 
with the observations. We show that this approach to refinement is significantly more 
efficient than parameter estimation for models with functional uncertainty and that it 
provides greater robustness in the face of uninformative observations. 

• Herbert Kay. 1997. Robust identification using semiquantitative methods. IF AC Symposium 
on Fault Detection, Supervision and Safety for Technical Processes (SAFEPROCESS’97), 
Hull, UK, 26-28 August 1997. 


Abstract 

Describes SQUID, a new system identification method that uses refutation rather than 
search to identify a model of a physical system. By ruling out implausible models rather 
than searching for the best model that fits the data, SQUID is more robust in the face 
of uninformative data and structural model uncertainty than are traditional identification 
methods. 



